I have a USB stick contaning a number of ISO images that uses Grub to boot into whichever one is selcted from its menu. One of these ISOs is Tails.

Part of the USB stick is partitioned as a persistent volume that Tails recognises when booted from the ISO. I have not used it much but first impressions are that it works fine.

I also tried a persistent volume on a separate USB stick and that also worked fine.

Now I am aware that the Tails website suggests that

It is only possible to create a persistent volume if the device, USB stick or SD card, was installed using Tails Installer.

However, my experience shows that it works fine with an ISO. Sure, Tails won't create a persistent volume when booted from an ISO, but it will use one that it finds on a conected storage device.

So I want to ask whether there are any reasons to recommend against using an ISO image and persistent volume in this way.

(Tails version 2.6)

Same thing - at the end, whoever created a kernel-recognizable persistent volume - it's just mounted and used. No difference at all in any matters.

up vote 0 down vote accepted

It is fine to use an ISO image and persistent volume in the way the question describes. However, You can create persistent volumes on any device but Tails won't do it for you and such configurations aren't supported.

Tails persistent volumes can go on any device. From the persistence design documentation:

the underlying tools will support storage on whatever relevant device

and

brave and advanced users can prepare their store their persistent data wherever they want

and

this is not something we will actively support and document beyond the bare minimum (--help and manpage)

How to create a persistent volume

  1. Create a partition named TailsData (this is how Tails recognises a persistent partition);
  2. Create a LUKS volume on the partition: cryptsetup luksFormat ...;
  3. Create a EXT4 filesystem in the LUKS volume mkfs.ext4 ...;
  4. Mount the filesystem (e.g. on /mnt);
  5. Set ACLS on the root directory: setfacl -m user:115:rwx,group::rwx,mask::rwx /mnt;
  6. Create file /mnt/persistence.conf with mode 600 and ownership 155:122, with contents as descrbed below.

Tails uses the persistence.conf file to mount diretories on the persistent volume onto the filesystem. For example, the line

/home/amnesia/Persistent source=Persistent

makes the Persistent directory on the persistent volume available as the /home/amnesia/Persistent directory. When Tails creates this file. the whitespace between the two parts is a tab, however a space also works.

A more complete example persistence.conf is shown below:

/home/amnesia/Persistent source=Persistent
/home/amnesia/.gnupg source=gnupg
/home/amnesia/.ssh source=openssh-client
/home/amnesia/.purple source=pidgin
/home/amnesia/.claws-mail source=claws-mail
/home/amnesia/.gnome2/keyrings source=gnome-keyrings
/home/amnesia/.mozilla/firefox/bookmarks source=bookmarks
/etc/cups source=cups-configuration
/home/amnesia/.icedove source=icedove

An example

Given the GPT partition /dev/sdj3, as root :

# cryptsetup luksFormat /dev/sdj3
# cryptsetup open /dev/sdj3 tailsdata
# mkfs.ext4 /dev/mapper/tailsdata
# mount /dev/mapper/tailsdata /mnt
# echo '/home/amnesia/Persistent source=Persistent' > /mnt/persistence.conf
# chown 115:122 /mnt/persistence.conf
# chmod 600 /mnt/persistence.conf
# setfacl -m user:115:rwx,group::rwx,mask::rwx /mnt
# umount /mnt
# cryptsetup close tailsdata

It is important to set the permissions (chown, chmod and setfacl) correctly otherwise Tails will disable persistence.

Tails will create the directories defined in persistence.conf. If you want to precreate them set their ownership appropriately (1000:1000 for content beneath /home/amnesia; as appropriate for other directories).

Tails will also create an empty file called live-additional-software.conf. This is an optional file that allows additional packages to be installed from the persistent volume. See here for more information about this.

When mounted, the root of the persistent volume is at /live/persistence/TailsData_unlocked.

Further reading:

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.